# Grok filter for the logs coming from Nagios **URL:** \ **Category:** Logstash\ **Created:** [December 3, 2019, 10:31pm UTC](https://discuss.elastic.co/t/grok-filter-for-the-logs-coming-from-nagios/210435 "2019-12-03T22:31:49Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Morymogh](https://avatars.discourse-cdn.com/v4/letter/m/c68b51/32.png) [@Morymogh](https://discuss.elastic.co/u/Morymogh)\ **Post date:** [December 3, 2019, 10:31pm UTC](https://discuss.elastic.co/t/grok-filter-for-the-logs-coming-from-nagios/210435/1 "2019-12-03T22:31:50Z")
Can someone please assist to write a grok filter for the below raw data captured by tcpdump? The logs are tagged as "siem" to be forwarded from a Nagios server to our elasticsearch, basically ["siem"] shows end of the each message. {"message":"\<14\>2019-11-25T15:27:02.943087+11:00 compute-2201-1210502.domain.tld audispd[39023]: node=compute-2201-1210502.domain.tld type=PATH msg=audit(1574656022.937:25241450): item=0 name="/usr/bin/sudo" inode=54938 dev=fc:02 mode=0104755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL","[@Version](https://github.com/Version)":"1","[@timestamp](https://github.com/timestamp)":"2019-11-25T04:27:02.675Z","type":"syslog","host":"10.5.0.174","tags":["siem"]}{"message":"\<85\>Nov 25 04:27:00 22rrpcsu0316 sudo: monitor : TTY=unknown ; PWD=/home/monitor ; USER=root ; COMMAND=/sbin/pvs --noheadings -o pv\_name,pv\_attr","[@Version](https://github.com/Version)":"1","[@timestamp](https://github.com/timestamp)":"2019-11-25T04:27:02.683Z","host":"10.5.0.12","port":38612,"type":"syslog","tags":["siem"]}{"message":"\<85\>Nov 25 04:27:00 22rrpcsu0316 sudo: monitor : TTY=unknown ; PWD=/home/monitor ; USER=root ; COMMAND=/sbin/vgs --noheadings -o vg\_name,vg\_attr","[@Version](https://github.com/Version)":"1","[@timestamp](https://github.com/timestamp)":"2019-11-25T04:27:02.683Z","host":"10.5.0.12","port":38612,"type":"syslog","tags":["siem"]}{"message":"\<14\>2019-11-25T15:27:02.954896+11:00 compute-2201-1210502.domain.tld audispd[39023]: node=compute-2201-1210502.domain.tld type=USER\_START msg=audit(1574656022.949:25241451): pid=247906 uid=0 auid=10054 ses=2024952 msg='op=PAM:session\_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'","[@Version](https://github.com/Version)":"1","[@timestamp](https://github.com/timestamp)":"2019-11-25T04:27:02.683Z","type":"syslog","host":"10.5.0.174","tags":["siem"]}I [![@kares](https://avatars0.githubusercontent.com/u/45967?s=88&v=4)](https://github.com/kares) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [December 3, 2019, 11:07pm UTC](https://discuss.elastic.co/t/grok-filter-for-the-logs-coming-from-nagios/210435/2 "2019-12-03T23:07:46Z")
Please use [markdown](https://github.com/adam-p/markdown-here/wiki/Markdown-Cheatsheet) to format your message. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 31, 2019, 11:12pm UTC](https://discuss.elastic.co/t/grok-filter-for-the-logs-coming-from-nagios/210435/3 "2019-12-31T23:12:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.